AlmaLinux 9.2 [TuxCare] Security Update: tigervnc / tigervnc-icons / tigervnc-license / tigervnc-selinux / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1744223313)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1744223313 advisory. - A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents function. This issue occurs wh...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: perl-DBI (UTSA-2026-126156)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-126156 advisory. DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment. The preparse method normalises SQL and removes...

AlmaLinux 9.2 [TuxCare] Security Update: nano (ALMALINUX9.2:CLSA-2026:1780920842)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780920842 advisory. - A flaw was found in nano. A local user could exploit a format string vulnerability in the statusline function. By creating a directory with...

Rocky Linux 9.6 [TuxCare] Security Update: kernel / kernel-abi-stablelists / kernel-core / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1782382498)

"The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1782382498 advisory. - In the Linux kernel, the following vulnerability has been resolved: efi: Do not import certificates from UEFI Secure Boot for T...

AlmaLinux 9.2 [TuxCare] Security Update: python3-unbound / unbound / unbound-devel / unbound-libs Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1786637650)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1786637650 advisory. - The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service resource consumption by arranging fo...

SUSE CVE-2026-85644

XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a list-associative infix operator checks whether arguments are array references, but it tests using SvRV rather than SvROK. SvRV reads a union slot...

SUSE CVE-2026-88815

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv. When casting to SQLNUMERIC, sqltypecastsvpv passes the string pointer and length of the SV to groknumber without stringifying it first. An integer IV or floating-point NV value has no valid string...

SUSE CVE-2026-88816

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrowhashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer IV or floating-point NV...

Linux Distros Unpatched Vulnerability : CVE-2026-85644

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix generates for a...

PT-2026-102758

Name of the Vulnerable Software and Affected Versions Azure RTOS affected versions not specified Description In builds with TX ENABLE EVENT TRACE enabled, a user-mode, memory-protected module using TXM MODULE USER MODE | TXM MODULE MEMORY PROTECTION can register an arbitrary function pointer as t...

CVE-2026-18746 NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted

parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...

CVE-2026-18746 NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted

parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...

No title provided

A flaw was found in Eclipse OpenJ9. A remote attacker with low privileges could exploit this vulnerability by convincing a user to process a specially crafted .class file containing deeply nested annotations. This could lead to a segmentation fault, resulting in a Denial of Service DoS for the...

K000163437: Vim vulnerabilities CVE-2026-28420, CVE-2026-28421, and CVE-2026-28422

Security Advisory Description CVE-2026-28420 Vim is an open source, command line text editor. Prior to version 9.2.0076, a heap-based buffer overflow WRITE and an out-of-bounds READ exist in Vim's terminal emulator when processing maximum combining characters from Unicode supplementary planes...

AZL-105212 CVE-2026-88815 affecting package perl-DBI 1.652-1

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv. When casting to SQLNUMERIC, sqltypecastsvpv passes the string pointer and length of the SV to groknumber without stringifying it first. An integer IV or floating-point NV value has no valid string...

AZL-105215 CVE-2026-88816 affecting package perl-DBI 1.652-1

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrowhashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer IV or floating-point NV...

CVE-2026-88816

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrowhashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer IV or floating-point NV...

DEBIAN-CVE-2026-88815

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv. When casting to SQLNUMERIC, sqltypecastsvpv passes the string pointer and length of the SV to groknumber without stringifying it first. An integer IV or floating-point NV value has no valid string...

CVE-2026-88815

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv. When casting to SQLNUMERIC, sqltypecastsvpv passes the string pointer and length of the SV to groknumber without stringifying it first. An integer IV or floating-point NV value has no valid string...

DEBIAN-CVE-2026-88816

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrowhashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer IV or floating-point NV...